{{- if .Values.istio.internal.ingressControllers }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ingress-gateway-controller
  namespace: d8-ingress-{{ .Chart.Name }}
  {{- include "helm_lib_module_labels" (list $ (dict "app"  "ingress-gateway-controller")) | nindent 2 }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: istio:ingress-gateway-controller
  namespace: d8-ingress-{{ .Chart.Name }}
  {{- include "helm_lib_module_labels" (list $ (dict "app"  "ingress-gateway-controller")) | nindent 2 }}
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: istio:ingress-gateway-controller
  namespace: d8-ingress-{{ .Chart.Name }}
  {{- include "helm_lib_module_labels" (list $ (dict "app"  "ingress-gateway-controller")) | nindent 2 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: istio:ingress-gateway-controller
subjects:
- kind: ServiceAccount
  name: ingress-gateway-controller
{{- end }}
